Data Subject Rights Letter – Additional Time Required
Data protection law in the UK, comprising principally of the UK GDPR and the Data Protection Act 2018, provides a range of rights for individuals (“data subjects”) designed to help protect their personal data as well as their own rights, interests, and freedoms.
This letter includes options for different scenarios where a longer response time is required. Ordinarily, you must respond to a request from a data subject to exercise their rights within one month. In some cases, however, particularly where a request is complex (or numerous), this can be extended by up to two months.
There are four main scenarios in which this letter can be used:
1. Where it is clear from the outset that it will take longer to respond;
2. Where you initially responded to the individual and informed them that you would respond to their request within one month but, on further consideration of their request, need more time;
3. Where you requested confirmation of an individual’s identity and now, having received it, have determined that you will need more time;
4. Where you requested a fee (for a manifestly unfounded or excessive request) and now, having received it, have determined that you will need more time.
Where you do not need longer than the standard month to respond, please use the other letters available in this subfolder.
Optional phrases / clauses are enclosed in square brackets. These should be read carefully and selected so as to be compatible with one another. Unused options should be removed from the document.
Once you have purchased access to the appropriate document folder click on the “Download Document” link below. You will be asked what you want to do with the file. It is recommended that you save the document to a location of your choice prior to viewing.